package com.yc.jdbc.d1216;

import java.sql.*;

public class JdbcDemo {

    public static void main1(String[] args) throws ClassNotFoundException, SQLException {
        // 加载驱动
        Class.forName("oracle.jdbc.driver.OracleDriver");
        // 获取链接  localhost 表示本机域名(地址), 1521是oracle默认端口, sid 服务名
        String url = "jdbc:oracle:thin:@localhost:1521:helowin";
        String username = "scott";
        String password = "a";
        Connection conn = DriverManager.getConnection(url, username, password);
        // 创建语句
        Statement stat = conn.createStatement();
        // 执行语句
        ResultSet rs = stat.executeQuery("select sysdate from dual");
        // 移动游标
        rs.next();
        System.out.println("rs.getDate(1) = " + rs.getDate(1));
        // 关闭资源
        rs.close(); // 关闭结果集
        stat.close(); // 关闭语句
        conn.close(); // 关闭连接
    }

    public static void main(String[] args) throws SQLException {
        System.out.println("-------------- 正常查询 ------------------");
        queryEmpByEname("SCOTT");
        System.out.println("-------------- SQL注入攻击 ------------------ 用户信息泄露");
        queryEmpByEname("' or '1'='1");
        System.out.println("-------------- 避免SQL注入攻击 ------------------");
        queryEmpByEname1("' or '1'='1");
        System.out.println("-------------- 正常查询 ------------------");
        queryEmpByEname1("SCOTT");
    }

    public static void queryEmpByEname(String ename) throws SQLException{
        // 加载驱动 会自动加载
        // Class.forName("oracle.jdbc.driver.OracleDriver");
        // 获取链接  localhost 表示本机域名(地址), 1521是oracle默认端口, sid 服务名
        String url = "jdbc:oracle:thin:@localhost:1521:helowin";
        String username = "scott";
        String password = "a";
        Connection conn = DriverManager.getConnection(url, username, password);
        // 创建语句
        Statement stat = conn.createStatement();
        // 执行语句
        String sql = "select * from emp where ename = '"+ename+"'";
        System.out.println("sql = " + sql);
        ResultSet rs = stat.executeQuery(sql);
        // 移动游标
        while(rs.next()){
            System.out.printf("姓名: %10s 岗位: %10s 工资: %6d 入职时间: %s \n",
                    // 必须大写字段
                    rs.getString("ENAME"),
                    rs.getString("JOB"),
                    rs.getInt("SAL"),
                    rs.getDate("HIREDATE"));
        }
        // 关闭资源
        rs.close(); // 关闭结果集
        stat.close(); // 关闭语句
        conn.close(); // 关闭连接
    }

    public static void queryEmpByEname1(String ename) throws SQLException{
        // 加载驱动 会自动加载
        // Class.forName("oracle.jdbc.driver.OracleDriver");
        // 获取链接  localhost 表示本机域名(地址), 1521是oracle默认端口, sid 服务名
        String url = "jdbc:oracle:thin:@localhost:1521:helowin";
        String username = "scott";
        String password = "a";
        Connection conn = DriverManager.getConnection(url, username, password);
        // 创建语句
        //Statement stat = conn.createStatement();
        // 执行语句
        String sql = "select * from emp where ename = ?";  // ? 参数占位符
        System.out.println("sql = " + sql);
        // 预编译语句对象, 支持参数占位符, 可以避免 sql 注入攻击
        PreparedStatement stat = conn.prepareStatement(sql);
        // 设置查询参数, 参数索引从 1 开始
        stat.setString(1, ename);
        // 执行预编译语句对象时, 不能再传 sql 语句
        ResultSet rs = stat.executeQuery();
        // 移动游标
        while(rs.next()){
            System.out.printf("姓名: %10s 岗位: %10s 工资: %6d 入职时间: %s \n",
                    // 必须大写字段
                    rs.getString("ENAME"),
                    rs.getString("JOB"),
                    rs.getInt("SAL"),
                    rs.getDate("HIREDATE"));
        }
        // 关闭资源
        rs.close(); // 关闭结果集
        stat.close(); // 关闭语句
        conn.close(); // 关闭连接
    }

}
